A security analyst notices an increase in requests to a web application that contain encoded characters. The ASM policy is configured to block encoded attacks. The analyst wants to verify the policy is actually blocking these requests. Which log review approach provides the most reliable confirmation?

Analyze the web server logs to see if the encoded requests reached the backend application.

Check the ASM policy configuration to confirm the 'block encoded attacks' setting is enabled.

Search the ASM logs for violations related to encoded attacks and confirm the actions taken include 'blocked' for the relevant requests.

Review the BIG-IP network logs to see if the source IPs of the encoded requests are being reset.

Which action best validates that a configuration mitigates a specific vulnerability?

Checking the system's patch level

Reviewing the vulnerability scanner report

Attempting to exploit the vulnerability against the configured system

Reading the vendor's security advisory

A security team deployed an ASM policy to mitigate a critical CVE. The policy is in blocking mode. After deployment, the team sends a proof-of-concept exploit and the ASM log shows a 'blocked' action. However, the application team reports that the exploit still reaches the backend. Which analysis best explains this discrepancy?

The application team is checking the wrong backend server logs, and the request was actually blocked by the WAF.

The ASM policy is in blocking mode, but the signature for the CVE is not enabled in the policy.

The ASM log shows the request was blocked, but the application team may be observing a different request that bypassed the WAF, such as traffic to a different virtual server or direct-to-backend traffic.

The ASM log is showing a false positive, and the request was actually allowed through.

Which observation would confirm that a rate-limiting mitigation is working?

All traffic is passing through without any restrictions

Excessive requests from a single IP are being throttled or blocked

The firewall rules are unchanged

An administrator configured an iRule to redirect HTTP requests to HTTPS to mitigate a downgrade attack. After deployment, the administrator wants to verify the redirect is working. Which test provides the most conclusive evidence?

Check the BIG-IP statistics to see if the number of HTTP requests decreased after deployment.

Send an HTTP request to the virtual server and confirm the response is a 301/302 redirect to the HTTPS URL.

Verify the iRule is attached to the HTTP virtual server and the virtual server is enabled.

Review the iRule code to confirm the HTTP::redirect command is present and the HTTPS virtual server is specified.

F5Certified Solution Expert, Security

Domain 3Objective 7

3.07 Verify a Configuration Is Functioning as Intended to Mitigate a Vulnerability 401 Practice Questions (Page 3)

Part of the OPERATION AND IMPLEMENTATION domain, which makes up ~38% of our current practice bank. F5 does not publish an official question count, but from its 105-minute exam (~40–70 total, ~15–27 in this domain), expect 2–4 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

6concepts

Questions 11–15

11application · medium
A security analyst notices an increase in requests to a web application that contain encoded characters. The ASM policy is configured to block encoded attacks. The analyst wants to verify the policy is actually blocking these requests. Which log review approach provides the most reliable confirmation?
Select an answer first
12foundation · easy
Which action best validates that a configuration mitigates a specific vulnerability?
Select an answer first
13expert · hard
A security team deployed an ASM policy to mitigate a critical CVE. The policy is in blocking mode. After deployment, the team sends a proof-of-concept exploit and the ASM log shows a 'blocked' action. However, the application team reports that the exploit still reaches the backend. Which analysis best explains this discrepancy?
Select an answer first
14foundation · easy
Which observation would confirm that a rate-limiting mitigation is working?
Select an answer first
15application · easy
An administrator configured an iRule to redirect HTTP requests to HTTPS to mitigate a downgrade attack. After deployment, the administrator wants to verify the redirect is working. Which test provides the most conclusive evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “401” is a trademark of its owner, used for identification only.

3.07 Verify a Configuration Is Functioning as Intended to Mitigate a Vulnerability 401 Practice Questions (Page 3)

Questions 11–15

Which action best validates that a configuration mitigates a specific vulnerability?

Which observation would confirm that a rate-limiting mitigation is working?

An administrator configured an iRule to redirect HTTP requests to HTTPS to mitigate a downgrade attack. After deployment, the administrator wants to verify the redirect is working. Which test provides the most conclusive evidence?

Keep studying — OPERATION AND IMPLEMENTATION